hxxps://a[.]squareupmessaging[.]com/CL0/https[:]/app[.]squareup[.]com/pay-invoice/invtmp[:]6dabcd88-ee7b-4209-b60b-7055dfe113a6/1/0101019fe6d4da59-0922545c-1f7f-4cfd-a2ca-220daf448c72-000000/7m8_UoylZczQ07avvg6xTfQ_E8-bAlU9X_nHV0PK2UM=452

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://a.squareupmessaging.com/CL0/https:/app.squareup.com/pay-invoice/invtmp:6dabcd88-ee7b-4209-b60b-7055dfe113a6/1/0101019fe6d4da59-0922545c-1f7f-4cfd-a2ca-220daf448c72-000000/7m8_UoylZczQ07avvg6xTfQ_E8-bAlU9X_nHV0PK2UM=452
Sample260809-t7wpbsvvhw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2248	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307673613800697"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{50C781FA-B090-4268-8267-91A31B8241EE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{4A7D8DD0-D2A1-4FA2-A460-7F27574BCDA5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5900	msedge.exe
5900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4704	4384	msedge.exe	86
PID 4384 wrote to memory of 2248	4384	msedge.exe	87
PID 4384 wrote to memory of 4264	4384	msedge.exe	88
PID 4384 wrote to memory of 4264	4384	msedge.exe	88
PID 4384 wrote to memory of 4264	4384	msedge.exe	88
PID 4384 wrote to memory of 2992	4384	msedge.exe	89
PID 4384 wrote to memory of 2992	4384	msedge.exe	89
PID 4384 wrote to memory of 1020	4384	msedge.exe	90
PID 4384 wrote to memory of 1020	4384	msedge.exe	90
PID 4384 wrote to memory of 1020	4384	msedge.exe	90
PID 4384 wrote to memory of 4512	4384	msedge.exe	91
PID 4384 wrote to memory of 4512	4384	msedge.exe	91
PID 4384 wrote to memory of 4512	4384	msedge.exe	91
PID 4384 wrote to memory of 2432	4384	msedge.exe	93
PID 4384 wrote to memory of 2412	4384	msedge.exe	94
PID 4384 wrote to memory of 2432	4384	msedge.exe	93
PID 4384 wrote to memory of 2432	4384	msedge.exe	93
PID 4384 wrote to memory of 2412	4384	msedge.exe	94
PID 4384 wrote to memory of 2412	4384	msedge.exe	94
PID 4384 wrote to memory of 1028	4384	msedge.exe	98
PID 4384 wrote to memory of 1028	4384	msedge.exe	98
PID 4384 wrote to memory of 1028	4384	msedge.exe	98
PID 4384 wrote to memory of 568	4384	msedge.exe	99
PID 4384 wrote to memory of 4612	4384	msedge.exe	100
PID 4384 wrote to memory of 568	4384	msedge.exe	99
PID 4384 wrote to memory of 4612	4384	msedge.exe	100
PID 4384 wrote to memory of 5100	4384	msedge.exe	102
PID 4384 wrote to memory of 1740	4384	msedge.exe	104
PID 4384 wrote to memory of 1740	4384	msedge.exe	104
PID 4384 wrote to memory of 1740	4384	msedge.exe	104
PID 4384 wrote to memory of 2524	4384	msedge.exe	105
PID 4384 wrote to memory of 2524	4384	msedge.exe	105
PID 4384 wrote to memory of 2340	4384	msedge.exe	108
PID 4384 wrote to memory of 2340	4384	msedge.exe	108
PID 4384 wrote to memory of 2340	4384	msedge.exe	108
PID 4384 wrote to memory of 4620	4384	msedge.exe	109
PID 4384 wrote to memory of 4620	4384	msedge.exe	109
PID 4384 wrote to memory of 4620	4384	msedge.exe	109
PID 4384 wrote to memory of 3980	4384	msedge.exe	110
PID 4384 wrote to memory of 3980	4384	msedge.exe	110
PID 4384 wrote to memory of 3980	4384	msedge.exe	110
PID 4384 wrote to memory of 1504	4384	msedge.exe	111
PID 4384 wrote to memory of 1504	4384	msedge.exe	111
PID 4384 wrote to memory of 3640	4384	msedge.exe	112
PID 4384 wrote to memory of 5436	4384	msedge.exe	117
PID 4384 wrote to memory of 5444	4384	msedge.exe	118
PID 4384 wrote to memory of 5452	4384	msedge.exe	119
PID 4384 wrote to memory of 6120	4384	msedge.exe	121
PID 4384 wrote to memory of 6120	4384	msedge.exe	121
PID 4384 wrote to memory of 5208	4384	msedge.exe	122
PID 4384 wrote to memory of 5208	4384	msedge.exe	122
PID 4384 wrote to memory of 5900	4384	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://a.squareupmessaging.com/CL0/https:/app.squareup.com/pay-invoice/invtmp:6dabcd88-ee7b-4209-b60b-7055dfe113a6/1/0101019fe6d4da59-0922545c-1f7f-4cfd-a2ca-220daf448c72-000000/7m8_UoylZczQ07avvg6xTfQ_E8-bAlU9X_nHV0PK2UM=452
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ff9cffac188,0x7ff9cffac194,0x7ff9cffac1a0
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,15480296691594931317,5939263308048626839,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15457925453504141230,13475940741312717924,262144 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,8619366438947101114,8622441133930151153,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8589805024026096920,2239536299047606111,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5562522309200175798,10346838303080598899,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13207020653436367936,12301432331878919304,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14316322453273085814,15062105565154533120,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4972,i,10644501809092517364,13019799295521504170,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,10420971202542917423,3537016729939443776,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14803800420332806673,369474398636992135,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3533980031272051069,6816090067815594406,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3533980031272051069,6816090067815594406,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6204,i,13290592186639845599,6120504022726465472,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,6014675593985797701,3448411803651486507,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6528,i,4410476573974906166,16189436879887593634,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6704,i,13039128790035643851,11539221592245108751,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7496,i,2147220301348197166,2227935309453672261,2097152 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,12740083491851523610,14555145703469062274,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,13647395834148706545,9122257853183676065,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,4505301631393239285,16291129679904569812,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,8377389829920374677,1197521816107947767,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,10365321758046303673,16809738046770467921,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,12394603843393544788,2594951093858457099,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,11220378006127957055,6382799218091263457,524288 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1800,i,2961204106189740446,3161032328909639507,262144 --field-trial-handle=2040,i,15981169445892827007,13851540476553667246,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77f923b8b9ac078162b17f45285232ccf22151df7a9141b245e116d802470629
MD5 559a1003d517b2f829773181bbea262d
SHA1 63c3fc6e81a910845c7618bc08048b89324ebc81
SHA512 2c27fb26b18357c6a14154f2efe54b7aa1ad74aea055c9efff43c0a5053ab064a5714b284db587787062c4e970f84361c61f40906d617e6fc1b77c67b85df4c3
TLSH
T1FA812C2B06C65448DB601632E4D18906793DDC9DCF63BDA653BC4ABDF5067E14CC10C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a203.TMP
Size 3KB
SHA256 df427a9e74f43530c6b825a7af9bfbe2a745a2a03acf0b049f769fc4cd9bf59d
MD5 489a384fc446c38cfc9a6b76ff095ea4
SHA1 2b7835a868ff4b44f07637e9f0f4b153f8531e44
SHA512 743a2aeeda1f8110a3fd3950ceb4b561839773c2b64da942d2706dd0d7188859f915d02a6bea16129128b299bac663442e920e9985403d348da27a2d5f2be113
TLSH
T1E7710B2B0AC31459D7600632E4D10206793EDC9CCF63BD66537C447EFA0ABE28CD60C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d301e0cdac236f2893a6eb6da05f6dd3c3e5df19cc4c5986523a2226821c86e4
MD5 916500112600b82bb6abb004260f1f21
SHA1 3abc9d531d5e4f2f35670290ffc6819d8a6c5374
SHA512 57f8ba93dd597012e37647054cba63d29f90d73861604252a3bfa7886901a0b975804918d28a172515be9d847c51aedeaf89c65182e1b96f84b6576b6f91211e
SSDEEP 96:DpOf+XxzBt1qG0sahkLj4/QEhRBikZ9IBVK/xCyl5Hp+wBo:DsWXx1nqG0saWLj44EhHTZ9sVKJCyl54
TLSH
T11FA1A8F75BF0696E9E3191F0BA0A6E1BCFAD0424476C396B89D47E2253F6031E101A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1dbf2695fe4c97729dec61f8c4d4a5919f49664debff7d83ca96b476fab2b452
MD5 b8d43320717754f8fc166a216c69545f
SHA1 7e98975ffa88f80b1184e1cbf4eb7f0e2d37e900
SHA512 91416ca0eb303c60d7a8497b71c102c5c4cc81534d86e12e043985a98972de05c4a27ed54962928f1b3b0a9d12c806da5f2e3b639305f1c6009586efab244c71
SSDEEP 192:sxZTReyM/jK1Ml8MkO/f7sjJJIdpu0HW6+WNe39/Ywz4mnIgrJ:sxZTQMO/f7sjJCjHbQ/H9
TLSH
T1A052E7126A34A97BCCCBD209FA45BF53D6F91562D2940D54AAFCDA1C04E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5b188127f971a0c6af66e925d37ec7fbc8bcca090817cca400c66e85749385e1
MD5 165490108311502ffc6fd3d28bf6b30a
SHA1 a194c7a736b9d867cb6092ba0b1b4ad0c440974a
SHA512 d7a9f2fa3e0947b9266bf2e28d679755b7b1450736622ce660d46265587fc8723a940199bf6335eaee6d83654730be40c8112ace795a6963535e7075b075b56e
SSDEEP 192:sxZTReyM/jK1Ml8UQOkO/f7sEKJIdpU0HW6+WNe39/Yw75mnIg5EJ:sxZTQqlO/f7sEKCJHbQ/WW
TLSH
T11352E7126A349977CCCBE209B945BF53E6F9547292940E54AAFCDA1C04E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 95ba1d2adea6e6cc1e5ae78015f935156dede8cc93df9085424d4a3c8d40bfae
MD5 680992edf7503d3f6f0d58bd2ee279d9
SHA1 b6532a77109fe40df9c116dc6caae78a1d7d54bf
SHA512 2122b11c8630dcbfb8ce3cf6569a99ee69d2960ede732e8fc2fafe2412eba25e652b746bdbcf9bd5895a00f27d7307c85affcc3868eebe52e59c0771af3fe5dd
SSDEEP 768:Hg4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dIrohQ8uMad:Hg4jeXmWvmKxEu1jacPLZQdzCN
TLSH
T1CEE2093B240CCF7E4F844E5DED26AE876ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 671c4a3124940488861e3d1c69655f7adfb9e944721c8040852b2ea60f903733
MD5 19336c93780371b583f1240940f14a74
SHA1 1fe11369911ca1c0f921080a0e5fd049212a30c4
SHA512 f8d102c9f1b24f7896ccd5b7ac72fa800bf38d933db8156a98e95a221bc956cc377cbe8621758f4cb5179547dd004b6efb998d96fce2c4dd6d04f3d0297e5cc1
SSDEEP 48:Kk8IXKdOcfyl5IFKagIDLqlBL1VxUhEsI7pxK64CrxOTh9MpVSyM:Kk8gKdO+G5SKagtcwKVa2P
TLSH
T1B5913F2975BB52013C7F7D5C82A8875BCA427163340DA96BBBA800628F67E148DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 c9e598f8ce7a5026e87306fc83af7e422dc62ed0f70a8fc21ab2d7ffce4dad8f
MD5 aa525dbbc3a53d07c220b4a5057c65d6
SHA1 c4f76e0119c7272be38ce0e1a2335e9b33fa05c7
SHA512 e4da3be2ad778f972d81dc9df8313f5e92bf7bdf73a5b56e03ac3ae86c676a1091c5a452bb39d64cd61d379ce46ac88ff86e8fe3bedb528910967999c38e8f09
TLSH
T1E2812D2975BA52013C7F791C87A4875BCA427163340DA96ABBAC00638E77E148DFDDCD
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e4558702014738131865bbd6b0b7e7fa2a80a5099b8b91b0c786059dc31dabab
MD5 20feaef7cf62dbd1f70134cd69524b53
SHA1 f2c6da5a7f7796af9a10b5e3d796cc40c7810f05
SHA512 2acbe76d201ff511016fe6e9c48e5dc2a8255b6b47e1ee9c50d6c612ab1976f5f074184f6d19d42147ff7ac762fb9995538b1f388b2ef8277a9f381f4b5e41f8
SSDEEP 384:IZcIhsNOb2erPBMf+x82YEX239FCVnTKwBODNZOCA5k:2hsUM62nCVnewBKZO7k
TLSH
T1EE928D71683CAC775DD2B546F84A32134FF89127E6D83B98D6ED7B1D00AA698130FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 dcd07b4e111bbf98043cf76b0786fe98be170beee93c8da700b96a8f1c553701
MD5 dcc78470ad319715bd816f6475919eaf
SHA1 b917cd91fe4f14e7254359c0c9e9323e3a191567
SHA512 452089e51ae32985b9732c2d3f77b66179acd4b969ae0520959c60419bc52358677b265df24ac9a22d2bb6ec1783bcb51134de100cac40dcff71f51c7ec8e26a
SSDEEP 384:TZcIgzsNOI2erPZMf+x82YEX2n5FCVnTKwBODNZOCA5k:L8dAM62TCVnewBKZO7k
TLSH
T1C6C206F158EB5872D89EA747A77E2D034EBCD013B5982A54B3A86B0CCC5657FD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d7466b1478fa045dd48b9ab8c2f57b5f33cdc2074d705eb796f33f9215a151f
MD5 32c51215c196f54bd98a033a3c293c37
SHA1 1e54f7105f38aed6591332998a3b023ebd3ad8b6
SHA512 bc9778b1df59323195c45bf31b38d9e201a12a9f459add50808e731dc28e3c36ac612e3f4a9406ba8e9879d771ad6c460da7681e4282c1516dab1098c4253e1b
SSDEEP 192:EONs6hZ0QmiUy55pc/+jVLjzor2Yl5wOZCHjU6:EONs6ospu+x82Yk2CDU6
TLSH
T1B402D935A8786C778DE2AE46F48737235FE4112BEA956F84D6EC1B1C00D769C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 beeb5b56708b137803ccf95a0ca3cf24686383d09d471eeda70351da5c9d9cc7
MD5 9eadd59ba9c428dc97bac441829fc817
SHA1 a0db7137dcb7dd9dc3654944949ddb3a29fb5299
SHA512 39032eb7896063167f37434e592657ca5d375b9a1a8e168af6414cfc31724aac09aed8fae2c1652aeef5a025824ea24efd343b3044c15be8dcc879a75dcc4d6d
SSDEEP 192:fJON/6hZwQmiUyH5cc/+jVLjzor2YEXxEUmk5cOqCBrqIU6:BON/6socu+x82YEX259CVU6
TLSH
T16212EA326868AC675DD2B942F48736135FE5511BEA897F84D6EC2B1C00DF6AC134FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ff03ab3a2330e3372da94c2f85ee522cdee86760dc0b6176d8166955ef106c39
MD5 64ab60da6b15df416e9b6c2fd498f5d6
SHA1 4e40456f76f712d764bdc78d90a2d14351898986
SHA512 24a76fb36723d4360759c3c34426a96dfade09b0c44a414536f001bb278fd4e54e936599e4a490d1bee3242c0c491e1763021df2bbc3354a106e2ea6930a00bf
SSDEEP 384:cZcIhsNOI2erPBMf+x82YEX239FCVnTKwBODNZOCA5k:KhdUM62nCVnewBKZO7k
TLSH
T179927D71683CAC775DD2B546F84A36134EF89127E6D83F98D6ED7B1D00AA698130FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b0a844bf85e6ed0c0274f63c999b9f4e331471cc9e6fe93146b1e37ac8b082ec
MD5 760b0975ded402260d804c22b18f8b01
SHA1 a795680979381dc6917dfb5116bc54f764e78025
SHA512 7b9e71a2cfb5affa318567a12092ecd4b5673e8227e28bb413cd813e164f8e752bd316f58137286e0749090239cba3181d606219e12bd623cd7eaadf06c7cde8
SSDEEP 384:gZcIhsNOI2erPBMf+x82YEX239FCVnTKwBODNZOCA5k:ehdUM62nCVnewBKZO7k
TLSH
T10A928D71683CAC775DD2B546F84A36134EF89127E6D83F98D6ED7B1D00AA698130FC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

279cae8a-7d22-4f2f-be9f-19e8c5622a63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\279cae8a-7d22-4f2f-be9f-19e8c5622a63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e1c9c48b551878dd84938442970e6d501b6869a25e2003807a92bd0c22099c1f
MD5 0fa35d28a81cd9d4799e55c6a62d544f
SHA1 9e60710b9110639f734871610027769f226d5aac
SHA512 3a124d1fd47a4f2e1d26d0a8874006814d5dbcae384845c16da09cdbf7c2a1d6391ff285dc2c4440a6206bd9e60e54d51682ca3b266969028f8afc252f0f725b
TLSH
T1F741D658A6FD1148B3B66E5AAFF2A86E447FB9772E06D45E00110E4F0A22F00C872737
MD5 SHA1 SHA512 TLSH

Submit Download